Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,039cataloged exploits

39,796CVEs with public exploitation

24,695lab-tested

All Referência 25,790Exploit-DB 24,487GitHub PoC 16,910VulnCheck XDB 9,820Nuclei 4,504Metasploit 3,528✓ verified onlyrecent popular risk

16,910 exploits

GitHub PoC

Published Epson EH-TW5350 CVE · Hard-coded credentials · B-BEAM-BOB team

CVE-2021-43717CRITICAL29 Sep 2026

An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection

48RISK

open ↗

GitHub PoC★ 5

XWP_RCE — CVE-2026-87902 Hacker Console

CVE-2026-87902HIGHunder attack29 Sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RISK

open ↗

GitHub PoC

Sanitized CirrusSearch report and patch verification notes for CVE-2026-96873.

CVE-2026-96873MEDIUM29 Sep 2026

Reflected XSS in CirrusSearch debug explain output

33RISK

open ↗

GitHub PoC★ 52

Next.js RCE

CVE-2026-94545MEDIUM29 Sep 2026

Satori-generated SVG has improper escaping

33RISK

open ↗

GitHub PoC★ 1

ChinaRan0/CVE-2026-59310-POC 的优化版本。子命令、一次性 cron、带远端 PTY 的交互 shell。仅限授权测试。

CVE-2026-59310CRITICALunder attackransomware29 Sep 2026

vCenter directory-traversal vulnerability

78RISK

open ↗

GitHub PoC

Sanitized WikiLambda report and patch verification notes for CVE-2026-96872.

CVE-2026-96872LOW29 Sep 2026

WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

28RISK

open ↗

GitHub PoC

https://vuldb.com/cve/CVE-2026-102261

CVE-2026-102261MEDIUM29 Sep 2026

owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization

33RISK

open ↗

GitHub PoC

Published Epson EH-TW5350 CVE · Firmware update verification bypass · B-BEAM-BOB team

CVE-2021-43716CRITICAL29 Sep 2026

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector

48RISK

open ↗

GitHub PoC★ 1

CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware endpoint probe, lab-safe upload test. https://pocbit.org/pocs/cve-2026-8065

CVE-2026-8065CRITICAL29 Sep 2026

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions all

48RISK

open ↗

GitHub PoC

kiyingiericmark-wq/CVE-2020-24186

CVE-2020-24186CRITICAL29 Sep 2026

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

85RISK

open ↗

GitHub PoC

container escape POCs for CVE-2026-80521 and CVE-2026-52910

CVE-2026-80521HIGH29 Sep 2026

af_unix: Unlink scc_entry in unix_del_edge().

41RISK

open ↗

GitHub PoC

Minseo9503/cve-2025-30208

CVE-2025-30208MEDIUM29 Sep 2026

Vite bypasses server.fs.deny when using `?raw??`

70RISK

open ↗

GitHub PoC

CVE-2026-101108 PoC: OrdaSoft Joomla Vehicle Manager (Free) <=6.5.7 unauth SQLi — order_field/order_direction unquoted ORDER BY (com_vehiclemanager). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101108

CVE-2026-101108CRITICAL29 Sep 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

48RISK

open ↗

GitHub PoC

Published Epson EH-TW5350 CVE · Web Control authentication bypass · B-BEAM-BOB team

CVE-2021-43718MEDIUM29 Sep 2026

An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malici

33RISK

open ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96876.

CVE-2026-96876MEDIUM29 Sep 2026

Anonymous reflected XSS in CargoExport invalid-alias errors

33RISK

open ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96877.

CVE-2026-96877MEDIUM29 Sep 2026

Reflected XSS through Cargo Drilldown full-text search

33RISK

open ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96878.

CVE-2026-96878MEDIUM29 Sep 2026

Cargo Exhibit field alias allows stored XSS

33RISK

open ↗

GitHub PoC

Sanitized Wikibase report and patch verification notes for CVE-2026-100380.

CVE-2026-100380MEDIUM29 Sep 2026

Reflected XSS in Wikibase Special:SetLabel language validation

33RISK

open ↗

GitHub PoC

Sanitized UploadWizard report and patch verification notes for CVE-2026-100381.

CVE-2026-100381MEDIUM29 Sep 2026

UploadWizard Flickr collection and set titles allow DOM XSS

33RISK

open ↗

GitHub PoC

CVE-2026-82901 — Ultra Addons for Contact Form 7 Mass Exploiter (GUI + CLI)

CVE-2026-82901CRITICAL29 Sep 2026

Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

48RISK

open ↗

GitHub PoC

CVE-2026-8065CRITICAL29 Sep 2026

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions all

48RISK

open ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96874.

CVE-2026-96874LOW29 Sep 2026

Stored XSS in Cargo Drilldown tab names

28RISK

open ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96875.

CVE-2026-96875MEDIUM29 Sep 2026

Reflected XSS in Cargo Drilldown hierarchy filters

33RISK

open ↗

GitHub PoC★ 1

Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.

CVE-2026-63030CRITICALunder attack29 Sep 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISK

open ↗

GitHub PoC★ 28

ZeroDayEvil/CVE-2026-41940-PoC

CVE-2026-41940CRITICALunder attackransomware28 Sep 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RISK

open ↗

GitHub PoC★ 1

CVE-2026-87902 — WordPress Core LFI → RCE

CVE-2026-87902HIGHunder attack28 Sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RISK

open ↗

GitHub PoC

CVE-2026-100721 PoC: vm2 <3.12.2 NodeVM external allowlist bypass → sandbox escape / host RCE. Local Node lab (evil-left-pad), remote sandbox API mass exploit, colorful CLI. PoCbit — https://pocbit.org/pocs/cve-2026-100721

CVE-2026-100721CRITICAL28 Sep 2026

vm2 before 3.12.2 Authorization Bypass via Custom Resolver

48RISK

open ↗

GitHub PoC★ 169

🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.

CVE-2026-75604CRITICAL28 Sep 2026

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

63RISK

open ↗

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-88771CRITICALunder attack28 Sep 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

93RISK

open ↗

GitHub PoC★ 23

ZeroDayEvil/CVE-2026-62911

CVE-2026-62911HIGH28 Sep 2026

Microsoft Exchange Server Elevation of Privilege Vulnerability

41RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.